Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 614 of 807  Not logged in ELOG logo
ID Datedown Icon Author Author Email Category OS ELOG Version Subject
  1622   Tue Jan 24 08:11:13 2006 Reply Stefan Rittstefan.ritt@psi.chQuestion 2.6.0b5Re: Quicklink does not work for one field

mark james wrote:

mark james wrote:

Stefan Ritt wrote:

mark james wrote:
I am not so bold as to log this as a bug but one of my Quicklink fields just do not work.


Sorry my late reply, but now I have fixed this problem. The update is under SVN and will be contained in the next release.


Thanks for that. I am now using ver V2.6.1-1622. So I guess that doesn't qualify as a "next release". I wonder if there is anything I could do to work around the issue?

Mark

In fact now the dropdown seems to be working but when I 'tick' an entry, it is not being written to the ascii file.


Can you try V2.6.1-1634? I fixed several issues with ticking entries coming from "MOptions" lists.
  1621   Mon Jan 23 18:35:52 2006 Reply mark jamesmark@majames.comQuestion 2.6.0b5Re: Quicklink does not work for one field

mark james wrote:

Stefan Ritt wrote:

mark james wrote:
I am not so bold as to log this as a bug but one of my Quicklink fields just do not work.


Sorry my late reply, but now I have fixed this problem. The update is under SVN and will be contained in the next release.


Thanks for that. I am now using ver V2.6.1-1622. So I guess that doesn't qualify as a "next release". I wonder if there is anything I could do to work around the issue?

Mark

In fact now the dropdown seems to be working but when I 'tick' an entry, it is not being written to the ascii file.
  1620   Mon Jan 23 17:32:20 2006 Reply mark jamesmark@majames.comQuestion 2.6.0b5Re: Quicklink does not work for one field

Stefan Ritt wrote:

mark james wrote:
I am not so bold as to log this as a bug but one of my Quicklink fields just do not work.


Sorry my late reply, but now I have fixed this problem. The update is under SVN and will be contained in the next release.


Thanks for that. I am now using ver V2.6.1-1622. So I guess that doesn't qualify as a "next release". I wonder if there is anything I could do to work around the issue?

Mark
  1619   Mon Jan 23 11:18:48 2006 Reply djekdjek@xs4all.nlBug reportLinux2.6.1 Re: redirect errors via apache2
> > Since elog 2.6.0 we cannot redirect our elog via apache2.
> > 
> > in apache2.conf we have (had for a long time):
> > Redirect permanent /elog http://elog.oursite.com/elog/
> > ProxyPass /elog/ http://elog.oursite.com:8080/
> > 
> > When visiting the url, this results in:
> > The proxy server received an invalid response from an upstream server.
> > The proxy server could not handle the request GET /elog/myelog/.
> > 
> > After testing we found that ELOG V2.6.0-beta2 works just fine.
> > 2.6.0 stable crashes after visiting a redirected url.
> > 
> > Running on debian sarge
> 
> Have you tried 2.6.1. I released it just recently, so I don't know when it will be available for Debian.

No it doesn't work with 2.6.1. I hoped it would be fixed, but I should have reported it sooner.
I compiled 2.6.1 myself.
The original version was a debian package, after that, we compile elog ourselves and copy elogd manually over the old
version. Just to stay up-to-date.

> Have you checked that your "URL = xxx" statement in the config file is correct? I see above "myelog", while the
proxy passes requests to "elog".

I changed our urls, just to be safe.
myelog is a 'sublogbook', like forum here. http://elog.oursite.com/elog/myelog

We are running V2.6.0-beta2 and it runs fine, without any alterations to our config files.
All previous versions runned fine too.

update:
After further testing on a different server, it seems to be an issue with the proxy and the proxy_http modules in sarge.
after loading and unloading  proxy_http this is the error:
The proxy server received an invalid response from an upstream server.
  1618   Mon Jan 23 10:57:45 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6.1 Re: redirect errors via apache2
> Since elog 2.6.0 we cannot redirect our elog via apache2.
> 
> in apache2.conf we have (had for a long time):
> Redirect permanent /elog http://elog.oursite.com/elog/
> ProxyPass /elog/ http://elog.oursite.com:8080/
> 
> When visiting the url, this results in:
> The proxy server received an invalid response from an upstream server.
> The proxy server could not handle the request GET /elog/myelog/.
> 
> After testing we found that ELOG V2.6.0-beta2 works just fine.
> 2.6.0 stable crashes after visiting a redirected url.
> 
> Running on debian sarge

Have you tried 2.6.1. I released it just recently, so I don't know when it will be available for Debian. Have you
checked that your "URL = xxx" statement in the config file is correct? I see above "myelog", while the proxy
passes requests to "elog".
  1617   Mon Jan 23 10:30:51 2006 Question djekdjek@xs4all.nlBug reportLinux2.6.1 redirect errors via apache2
Since elog 2.6.0 we cannot redirect our elog via apache2.

in apache2.conf we have (had for a long time):
Redirect permanent /elog http://elog.oursite.com/elog/
ProxyPass /elog/ http://elog.oursite.com:8080/

When visiting the url, this results in:
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /elog/myelog/.

After testing we found that ELOG V2.6.0-beta2 works just fine.
2.6.0 stable crashes after visiting a redirected url.

Running on debian sarge
  1616   Sat Jan 21 14:02:57 2006 Reply Giorgio Croci Candianig.crocic@libero.itBug report 2.6.1Re: Access to global configuration in v2.6.1
 
> I tried to reproduce your problem, but could not. In my windows installation it looks fine. You only see the
> (save and cancel) buttons only if you go to "Change [global]", otherwise you see the "Change [global]", "Delete
> this logbook" etc. buttons. Have you tried with the default elogd.cfg which comes from the distribution?

Yes, I tried that. Maybe I'll have some other try on other PCs and investigate further, I'll surely let you know. Thanks
for the prompt response and compliments for your very good work! ELog is really a great piece of software.
  1615   Fri Jan 20 02:53:40 2006 Smile Chris Warnerchristopher_warner@dcd.uscourts.govCommentLinux2.6Re: Buffer Overflow?

Stefan Ritt wrote:

Chris Warner wrote:
Users can access root level directories by using a modified URL. I saw on some security web sites that this was a problem in previous versions. Was it not fixed in 2.6?

To recreate enter http://yourhost.yourdomain.com/../../../../etc/passwd

view your password file in the browser.

If this was previously reported, is there a fix?

Chris Warner


Thanks for telling me, I didn't know. I was able to reproduce your problem under certain conditions, and I just released version 2.6.1 to fix it. However it has nothing to do with an old buffer overflow (see elog:941).

I would strongly advise everybody to upgrade as soon as possible.


Thanks for the quick response!
ELOG V3.1.5-3fb85fa6